upupunvpa[.]xo[.]je

The domain upupunvpa.xo.je is currently active and classified as a high‑risk brand‑impersonation site targeting Microsoft users. Infrastructure analysis shows the domain resolves to IP 185.27.134.144, which is registered to AS34119 Wildcard UK Limited in Great Britain. The web server returns HTTP 200 and presents a page titled "Iniciar sesión en tu cuenta Microsoft," indicating a credential‑phishing attempt. The site uses Nginx with OpenResty, and client‑side libraries include jQuery and Google Hosted Libraries. SSL is provided by a ZeroSSL GmbH certificate issued by ZeroSSL ECC DV SSL CA 2, which does not mitigate the malicious intent. VirusTotal reports that 7 of 91 security vendors have flagged the domain, and it appears on one public blocklist, currently blocked by PhishDestroy. While the page content beyond the title has not been examined, the combination of a Microsoft‑focused title, credential‑phishing classification, and observed technical footprint confirms a phishing operation. Defenders should add the domain to outbound web‑filter deny lists, monitor DNS queries for the host, and consider sinkholing the IP address to disrupt traffic. Continuous re‑scanning with malware analysis tools is advised to detect any payload evolution, and any credential‑related alerts should be correlated with this indicator to assess compromise risk.